December 2003 - cypherpunks-legacy

From me to me to you...The Actual Article
by Carol Anne Braddock 17 Dec '03

17 Dec '03

Dear All of You, This is the article, and what I did with it. It is complete in it's entireity, from the bang paths, to the crosspostings. Please study them carefully, for my next post will contain the first response to the article, three days later. ALL DURING THIS TIME, I WAS LED TO BELIEVE, THROUGH PHONE CALLS THAT THIS WAS "GOING TO BE INVESTIGATED SOON". NOTHING OF THE SORT HAPPENED. NO ONE IN ANY OF THE TEN GROUPS RAISED A SINGLE OBJECTION. PERIOD. I believe in your capacity to fairly judge. My response to the first complaint lies still censored in my mail reader. For if .1% of all the Usenet is inappropriate to post to, when will it become just .01% ? Now, the article,

2 1

Re: Remailer Abuse
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > >See above. What's the difference between A-->B-->C-->B and A-->B-->C-->D ? >If someone is logging messages and routing, it's less secure, but then so is >the entire remailer system. Prime remailer operators are those who don't >log. > >Maybe message size would tip off snoopers. This can be overcome with minor >tweaking to existing remailer code by tacking on or or eliminating padding >to messages. But logging still makes the whole system extremely vulnerable. > >=D.C. Williams <dcwill(a)ee.unr.edu> > Message size can best be handled by using a remailer which uses messages which never change size. Mixmaster is now ready for testing. It still does not run on Linux or FreeBSD. I don't know what else it does run on. It works great on Sun machines with gcc. Since it is export restricted, send me mail and I will send you the name of the hidden directory to get the file. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLw+btVVkk3dax7hlAQFW/QP9GZAIODaKt/VYsDGWUExiY4NUapvnQpZ/ FWtucyqX+4v9JnJv318PaKEs5xqHMcqtdq0fGZn6qNe1k5MbSVBb5wzfclMQm3LY J7b3qv8zymedXpcmM2hm6bCnbpJkRivIjJTCDmg2yMKRH1Uv+Le5eN2haRxw3d76 e51KLqZJbh4= =BKtC -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.6 key available by finger or server. Encrypted mail welcome. Home page http://nately.ucsd.edu/~loki/ Home of "chain" the remailer chaining script. For anon remailer info, mail remailer(a)nately.ucsd.edu Subject: remailer-help "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

The Value of Anonymity
by mkj＠october.ducktown.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The value of anonymity, both on the nets and off, seems to be poorly understood, even among its strongest defenders. The positive value of anonymity is not merely about protecting a few special groups such as sexual-abuse victims and whistleblowers. While these are certainly valuable uses, if I believed that anonymity's positive impact were limited to these outside-the-mainstream groups, then I probably wouldn't accept the benefits of anonymity as outweighing its costs. But in fact, I believe that anonymity has crucially important benefits for nearly everyone. There are several good arguments to be made, but in the interest of brevity I'll focus on only one: The explosive development of such personal data industries as targeted marketing and consumer and demographic profiling, have demonstrated that the business community considers personal data to be of great economic value. (There's a parallel observation to be made here about governments, but I won't go into that now.) There are also myriad uses being made of personal data throughout the professions, from labor negotiators to house burglars. It is something of a truism that anyone who knows enough about you can probably find a way to beat you, either legally or illegally, often at great profit to themselves. In an information-age society without extremely strong privacy protections, the chief factor which makes the difference between winners and losers may be how much information each of us has on others, and how much they have on us. Given this degree of economic and social motivation, it is easy to imagine the sort of panopticon which will soon arise on the Internet (and its descendants), unless the strongest possible protections are adopted. (And it is equally easy to imagine who the biggest winners and losers will be.) Relying on government to protect personal privacy is like appointing the fox to guard the henhouse (or, as I seem to recall John Perry Barlow once putting it, "... getting a peeping tom to install your window blinds," or something like that). In addition to the government's own motivations for eroding privacy, all the above economic considerations enter into government through lobbying, desires to maximize tax revenues, fund-raising considerations, and a whole raft of other avenues. Furthermore, the only tools which government could bring to bear would be a complex web of laws and regulations governing the circulation of personal data. Such laws and regulations would have to constantly shift in a never ending cat-and-mouse game with business; and what's more, many of these laws and regulations would necessarily conflict with the free speech rights of private organizations. Bottom line: Anonymity is the only available tool which puts control over my own privacy firmly into my own hands, where it belongs, and does so without infringing on anyone's freedom of speech. Certainly there are drawbacks, and anonymity may invite some abuses; but we have survived anonymity's problems in the past, and 'tis better to suffer in the hell we know than to be dragged into a new and hotter one. The only society without any crime is a society without any freedom. My ($.02) conclusion: For preserving meaningful privacy, and for preventing an ugly and probably irreversible transformation of our world, anonymity is the best, perhaps the only viable tool we have. --- mkj -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLw+MZF11Wd4tm8clAQHC3QP8DrxVrUAUM+UKKeKzosFmCXGLkuwJYGDS nE+pFEFIDC8cq7/35h99oIrCszmnkIjwso8PhwlwqRzuxFTZPMI3XuK5wt95tJCL 6Iy2oQ7wjCv+xnL2QjdAGNl68WD0ZhmPv9Q62cvWYjzRXnQJJF7dZiES5l14/NM2 Ij4rLh8AdEo= =OGBF -----END PGP SIGNATURE-----

2 1

Re: The Value of Anonymity
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: mkj(a)october.ducktown.org > The value of anonymity, both on the nets and off, seems to be poorly > understood, even among its strongest defenders. The positive value of > anonymity is not merely about protecting a few special groups such as > sexual-abuse victims and whistleblowers. While these are certainly > valuable uses, if I believed that anonymity's positive impact were > limited to these outside-the-mainstream groups, then I probably > wouldn't accept the benefits of anonymity as outweighing its costs. These are good points. However I think your presentation is a little too oriented towards the libertarian perspective of distrusting government, and also comes off sounding harshly competitive: > It is something of a truism that > anyone who knows enough about you can probably find a way to beat you, > either legally or illegally, often at great profit to themselves. > > In an information-age society without extremely strong privacy > protections, the chief factor which makes the difference between > winners and losers may be how much information each of us has on > others, and how much they have on us. I think most people don't think so much in terms of winners and losers, of beating and being beaten. Rather, I think it will be more acceptable to couch the issue in simple privacy terms. People do value their privacy. I don't think you have to overly justify the value of privacy. A few examples of how little privacy people could actually have in a non-anonymous network of the future should suffice to establish motivation IMO. > Given this degree of economic > and social motivation, it is easy to imagine the sort of panopticon > which will soon arise on the Internet (and its descendants), unless > the strongest possible protections are adopted. I like this phrase! It nicely connotes the transparency of the nets. > Relying on government to protect personal privacy is like appointing > the fox to guard the henhouse (or, as I seem to recall John Perry > Barlow once putting it, "... getting a peeping tom to install your > window blinds," or something like that). In addition to the > government's own motivations for eroding privacy, all the above > economic considerations enter into government through lobbying, > desires to maximize tax revenues, fund-raising considerations, and a > whole raft of other avenues. This is where I think you are getting too libertarian for a broad audience. Also, this wording invites the reader to assume that anonymity will lead to tax avoidance and evading laws. Most people feel that they are paying their own taxes, and if others avoid them then it just increases the burden on themselves. So except to certain selected groups I would avoid playing this angle up. I think your next argument will have wider appeal: > Furthermore, the only tools which government could bring to bear would > be a complex web of laws and regulations governing the circulation of > personal data. Such laws and regulations would have to constantly > shift in a never ending cat-and-mouse game with business; and what's > more, many of these laws and regulations would necessarily conflict > with the free speech rights of private organizations. Be aware that this is in fact the "mainstream" solution to the problem. There was some discussion on comp.org.eff.talk of some kind of committee headed by EFF board member Esther Dyson which issued a statement on privacy protection in the nets. They issued the by-now traditional call for laws along the lines of "information collected for one purpose cannot be used for another purposes". Like, VISA can't sell data on your spending patterns, at least not without telling you. Nobody criticized this point; even the relatively net-aware civil liberties types mostly explicitly endorsed this provision. Laws like this are apparently already in place in Europe. So the momentum is in exactly this direction. I think your arguments are good ones; the government would undoubtedly exempt itself from such rules (the IRS is already starting to use dataveillance and matching to look for discrepencies between tax returns and spending patterns), plus such provisions would seem to require a labyrinth of exceptions, special cases, etc. Eventually I could see laws telling exactly what a business can and cannot do with the names of people who phone or net in for information; yes, they can be kept on a list for up to 6 months and sent additional promotional literature, except that the business must require standard form 11832 to allow the customer to get his name off the list, which must be handled within 5 working days for businesses with more than 100 employees, etc., etc. You could have volumes of this kind of stuff. I think Tim wrote some essays a long time back pointing out the absurdity of this approach, especially if you tried to apply it to private individuals. > Bottom line: Anonymity is the only available tool which puts control > over my own privacy firmly into my own hands, where it belongs, and > does so without infringing on anyone's freedom of speech. Certainly > there are drawbacks, and anonymity may invite some abuses; but we have > survived anonymity's problems in the past, and 'tis better to suffer > in the hell we know than to be dragged into a new and hotter one. The > only society without any crime is a society without any freedom. > > My ($.02) conclusion: For preserving meaningful privacy, and for > preventing an ugly and probably irreversible transformation of our > world, anonymity is the best, perhaps the only viable tool we have. That's a good summary. This is definately an uphill battle, though. I see no significant standards body or organization of influence (except for CPs, to the extent that we have any influence) which is moving in this direction. Add to this the costs of anonymity as Wei has been discussing and it really isn't clear how to proceed. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLxAj1xnMLJtOy9MBAQGujQIAqooWk8OsbJzbAGpxIP+EYnPJM0kA7Ojm /3i04Odoq/YZEH1Fv81/RbwsDahe+AGtmqU+VQ1KpjUTJuPfNKJ4dQ== =w/FH -----END PGP SIGNATURE-----

1 0

Anonymity and cost
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Wei Dai writes: > Anonymous e-mail that goes through a chain of N remailers will cost at > least N times as much bandwidth and have N times as much latency as normal > e-mail. But e-mail is hardly the state-of-the-art of network > communication, while anonymous e-mail IS the state of the art for > anonymous communication. How long will it take for the technology of > anonymous video conferencing to develope, for example? By then, of > course, those who are not concerned with anonymity will probably have > things such as full sensory virtual interaction. At a very basic level, anonymous (not pseudonymous, like the remailers are) messages are *cheaper*, because they carry less information; they do not need to send the bits which identify the sender. This conversation seems to elide distinctions between low-level anonymity (where source information is simply not transmitted) and high-level anonymity, where source information is transmitted but is not used for social or political reasons. Anonymous remailers are considered "anonymous" because (some of us) agree that we won't treat the "From:" line as indicating the real author of the text below. We agree this because we know how remailers work; we know that (probably) the person who wrote the message isn't the same person as the owner of the "From:" address. When we say a message is "anonymous" we mean that its real author should not/cannot be connected with the text of the message. We could just as easily agree on an "Identify-Author:" header field by which authors could indicate whether or not they wished to be speaking "on the record" when they wrote the message. A multi-hop message where the "From:" line changes with each hop costs almost precisely what a multi-hop message would cost without the "From:" line changes. Folks feeling detail-oriented can calculate the cost of the CPU time to strip header information vs. the cost of sending that header information to the next hop. I don't care about the answer, so I'm not going to. Anonymous video conferencing is available now; go to Kinko's, pay cash for the use of their video conference room. Or, ask/convince the recipient to consider the conversation "off the record". Current remailer operators experience a cost in that they receive some amount of hassle and exposure to liability by running remailers; but this is merely a "cost" shifted from one person (the author) to another, the surrogate author. This may look like a cost of anonymity but it's more accurately described as the cost of being provocative or rude or illegal. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLw8j133YhjZY3fMNAQGB5QP9HCgA2QiHLPVupVgOeU/Tez5SH8Ie3ch3 nSJreSYl3a97blPr/aI1Yx577EQuCwrHoyZKWWpVc/8u728i10gTbJPbavzpDBOw i3JawSt4+d/tMWBfLzYHzdrVALIcTZeGnmLLbfgzWzzC8NUDsDG/ppDB7sDq2ktf NiwvDeQzoYk= =oU42 -----END PGP SIGNATURE-----

2 2

Re: Too Much!
by L. Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Paul J. Ste. Marie writes: > At 01:16 AM 1/7/95 -0500, L. Todd Masco wrote: > >You might want to try reading it from NNTP, via c2.org or hks.net. You > >can then use Kill files. > > At that point, isn't the mailing list simply becoming a newsgroup? For that > matter, is there some reason that escapes me why it ISN'T a newsgroup? I > suppose the proportion of net.kooks is higher in a newsgroup than a mailing > list, but arguably we're ALL net.kooks here. Not really, not until a huge number of hosts carry it as a newsgroup. As for why cypherpunks isn't a newsgroup... IMO, it would end up carrying too much traffic and be way too high profile. As is, the people who really want to find it will and a hordes of riff-raff (not all, mind you) are less likely to bother with it. -- Todd - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxBD/yoZzwIn1bdtAQHMrAF8ChmS332TabEbGslXsxzOLqIHEBOnJBYs KIdzflR9PJWsYuNJBH6LrHtBWK/q7ejP =T4k6 -----END PGP SIGNATURE-----

1 0

Re: Remailer Abuse
by doumakes＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > One thing to keep in mind, though, is that it's really the _last_ remailer > in the chain that's taking the most heat, and it would be nice if they got > payed. There's also an issue of some remailers refusing to be last in the > chain, so they dont' expose themselves so much. I agree, this is an important issue. But I think it's a separate one from the question of how users pay for the service. In other words, once there's a consensus to have a Guild of for-pay remailers, all the users should have to do is pay the Guild once. The Guild can then haggle over how to divvy up the money. Hard jobs, such as posting anon news, should command more money. On the issue of the medium of exchange, I favor blinded digital cash with its absolute anonymity. The "remailer in a box" that we spoke of earlier would do well to include this capability. - -- ______________________________________________________________________ Don Doumakes Finger doumakes(a)netcom.com for PGP public key Foxpro databases built to your specifications. Email me for details. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLw3RTBtumcu2AjihAQF+DQQAmhQxuMl4C6VzZLD+mHF5i0OAjLUZAhV+ eNOi4F6bUBsDyfm7TmxxWMsiJRlJFrKhIMT+A16lmBZPdQ/pnZjQSk2keLyXgs0N phsPmZsTWGZMOyWGH+Hh2ggBc5syhmZxuTWwHFqqbAKTVoYRC4esxW8g/lTKot7F drI0amkbq20= =pHqY -----END PGP SIGNATURE-----

2 1

remailers
by Raul Deluth Miller 17 Dec '03

17 Dec '03

I'm wondering if I understand this remailer debate. Here's my summary (based not so much on reading of cypherpunk traffic, but on my understanding of the basic principles): (*) define an encrypting mailer protocol (basically, just PGP or some such). When a mailer receives an encrypted message, it unpacks (0) a message which may have been doubly encoded (once by originator, once by prior remailer to disguise padding) -- if so, must decrypt twice. (1) the message to be forwarded, annotated with control info (e.g. padding, delay, key to reencrypt under) (2) payment information in whatever format is advertised for that remailer. As I understand it the problem with digital cash is defining physical link for the "cash", without compromising the identity of whoever payed into the account. The proposal-to-date involves a guild of remailers. As I see it, this would be primarily of value for shuffling cash around -- call it a build of bankers instead. Once you've established your "cash"-net, presumably with related services such as drop-boxes and temporary accounts, you could use more flexible mechanisms for anonymous mail, which feed off the cash net where necessary. I've not read Chaum(sp?)'s work on encrypted cash, so perhaps I've ignored some terribly obvious issues. [No PGP signature -- at the moment, I don't have a host sufficiently secure to be worth bothering with.] -- Raul D. Miller N=:((*/pq)&|)@ NB. public e, y, n=:*/pq <rockwell(a)nova.umd.edu> P=:*N/@:# NB. */-.,e e.&factors t=:*/<:pq 1=t|e*d NB. (,-:<:)pq is four large primes, e medium x-:d P,:y=:e P,:x NB. (d P,:y)-:D P*:N^:(i.#D)y [. D=:|.@#.d

1 0

Re: The Value of Anonymity
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hear, hear! mkj's article on anonymity is worth reading. >From my perspective, the most important thing cryptography offers us is not just the ability to have private conversations without eavesdroppers; it's the ability to change the balance of power from the centralized control and accumulation of information that computers bring back to a level where _you_ can control what happens to your personal data. Do you _like_ starting transactions by giving some big company your Social Security Number which lets them, and everyone else, know everything you've ever done, where you live, how you vote, what you buy? We can move to a society where you can give the other party as much information as they need to do business with you, without having to give them everything else, or connect this transaction to all your others. Sometimes that means giving people more detail than you give them now, usually less. Cryptography becomes the technical glue to control how much you tell somebody on each transaction, anywhere from total anonymity to deep personal information, to let you have a driver's license that says "yes this person is a safe driver" without it becoming the key to your bank account of you lose your wallet, to have voter's registration that doesn't permit fraud but doesn't require universal identification. Some good technical references are the set of papers that David Chaum published about blind signatures and anonymous credentials. Bill

1 0

Re: From me to me to you...The Actual Article
by Erik Selberg 17 Dec '03

17 Dec '03

Carol Anne Braddock writes: > This is the article, and what I did with it. It is complete in it's > entireity, from the bang paths, to the crosspostings. Please study them > Now, the article, > Date: Sat, 7 Jan 1995 01:26:26 -0600 > From: Carol Anne Braddock <carolann(a)vortex.mm.com> > To: carolann(a)vortex.mm.com > Newsgroups: soc.support.transgendered, alt.transgendered, > mn.general, alt.sex.femdom, alt.artcom, alt.sex.bondage, alt.sex, > comp.infosystems.www.users, alt.dreams.lucid, alt.dreams > Subject: (fwd) Re: Phil Zimmermann So, I don't read any of those groups, and I could be dead wrong on all of this. But I'll yap away anyway. Off the cuff, I'd say your article could be inappropriate. Granted it's a good cause, and you're not advertising for yourself but for a charity. However, charitable spam is still spam (and I'm not calling your article spam... spam lite, maybe). I understand your point about feeling a sense of community with the above groups; however, I think that massive "Please help..." postings can be just as annoying as the MAKE.MONEY.FAST postings. Erik Selberg "I get by with a little help selberg(a)cs.washington.edu from my friends." http://www.cs.washington.edu/homes/selberg

1 0